GPU acceleration & the security model

GPU acceleration for the detection engine — opt-in, by design.

PoisonZero's detection engine runs CPU-only by default: a minimal, locked-down trusted computing base. GPU acceleration is an optional speed choice you turn on deliberately. Here is exactly what it changes, and how we keep the GPU path safe.

CPU-only is the defaultGPU is a separate, opt-in buildNetwork stays denied on both paths
What this page is

Why the engine is CPU-only by default.

The detection engine analyzes your agents' memory and configuration on-device. Keeping it CPU-only gives it the smallest, most auditable footprint, with no dependency on a graphics stack. If you want more throughput, you can opt into GPU acceleration — this page explains what that opt-in changes and how the GPU build is hardened.

The secure default

CPU-only is the high-security baseline.

None of this is optional — it is how every install runs unless you deliberately choose otherwise.

Minimal trusted computing base

A single static binary with a small, well-understood set of linked libraries. Less code in the trusted path means less that can go wrong or be attacked.

Sandboxed, network-denied

The engine runs as a locked-down subprocess under a deny-by-default profile: no network, tightly scoped filesystem access, no ability to spawn other programs.

Predictable footprint

On the CPU-only path the memory footprint is small and bounded. The engine starts on demand for a check and then exits, leaving only a few megabytes at rest.

What GPU acceleration changes

Why GPU is opt-in, not the default.

GPU acceleration is genuinely useful for throughput, but it widens the trusted computing base. That trade-off should be a deliberate choice, so it stays off unless you turn it on.

A larger attack surface

GPU work needs the graphics driver and a compute runtime — a large, closed, complex software layer that now sits inside the trusted path. That is more code to trust than the CPU-only build.

A narrow hole in the sandbox

To reach the GPU, the sandbox must open a specific, narrow path to the graphics device. We keep that opening as small as the hardware allows, but it is not zero.

Less controllable memory

VRAM and the driver's allocations are less tightly controllable than the CPU-only build's minimal, bounded footprint.

Re-validated per platform

Our fail-closed network guarantees are re-validated under the full GPU stack before we ship GPU support on each platform — never assumed to carry over.

How we harden the GPU build

The relaxation lives only in the GPU binary.

The GPU path is engineered so its extra surface never touches the default install.

A separate binary

GPU support ships as its own binary. The relaxation exists only there — the CPU-only binary is unchanged and stays the recommended default.

Minimal linked libraries

The GPU build links only what the compute path needs. We keep the added dependency set as small as the platform permits.

Network stays denied at the OS

Even on the GPU path, the engine is denied network access at the operating-system level. Opting into GPU speed does not open an egress path.

Signed, pinned, entitlement-gated

The engine will be signed and its hash pinned, and GPU mode will be entitlement-gated. It will not be possible to switch it on silently — only through an explicit, verified opt-in.

Availability

Where hardened GPU support is landing.

We ship GPU support platform by platform, only once its network isolation is re-validated under the GPU stack.

PlatformStatus
macOS (Apple Silicon, Metal) First hardened GPU target — shipping soon.
Linux (Vulkan)Coming soon Hardening in progress.
Windows (Vulkan)Coming soon Held until network isolation is re-validated under the GPU stack.
Until GPU support ships for your platform, the engine runs CPU-only — the secure default — with no change to how it behaves.
Bottom line

CPU-only by default. GPU when you choose it.

CPU-only stays the recommended default for the highest security. GPU acceleration is a transparent, opt-in speed choice — a separate, hardened build that never weakens the default install.

Run the secure default in under a minute.

Install the daemon and it runs CPU-only out of the box. Opt into GPU acceleration later, deliberately, when it ships for your platform.

Get the daemon